Bogus AGL Electricity Bill Email Points To Torrentlocker Ransomware
The original site is no longer online; links go to the Internet Archive copy.
The claim
Email purporting to be from Australian energy provider AGL supposedly contains details of your monthly bill and claims that you can click to view bill details or get more information.
What the fact-checkers found
The email is not from AGL. It is a criminal ruse designed to trick you into visiting a compromised website and downloading Torrentlocker ransomware. Once installed, Torrentlocker can encrypt your computer files and then demand that you pay a ransom to receive an encryption key.
Australian inboxes are currently being hit by a spate of emails that look like they come from Australian energy giant AGL. The emails appear to be a bill for your electricity account and include buttons that you can click to view your bill or get more information. The emails are professionally presented and feature the AGL logo.
However, the emails are certainly not from AGL and clicking the buttons will not open information about an electricity bill. The emails are designed to trick you into installing dangerous malware on your computer.
Clicking the links opens a webpage that appears to be part of the genuine AGL website. The page asks you to enter a Captcha code to access your bill. After you enter the code, a.zip file supposedly containing your bill will be downloaded to your computer. The.zip file harbours a malicious JavaScript file that, if opened, can download and install a version of the infamous Torrentlocker ransomware. Once installed, Torrentlocker can lock up all of your important computer files and then demand that you pay a ransom to online criminals to recover them.
Details, such as the bogus account number and bill amount, may vary in different versions of these emails. AGL has published a warning about this malware attack on its website, noting :
Customers and non-customers have received scam emails that pretend to be from AGL, which claim you owe money for an outstanding gas or electricity bill and ask you to click on a link to view your account or to make a payment.
Remember, AGL will never send you emails asking for personal banking or financial details.
Anyone receiving a suspicious email should delete it immediately or, if opened, not click on any links within the email. AGL advises recipients of any suspicious emails to run antivirus software and block the sender by adding to the junk folder list.
The names of other high-profile Australian entities, including Australia Post and the AFP, have been used in similar malware attacks in recent months. And, similar fake AGL bill emails have been used to distribute other types of malware.
Got a similar message?
Paste it into the detector and see whether it matches a known hoax.
Check a similar messageRelated fact-checks
Browse the archive →AGL “My Monthly Bill”; Malware Email
The email is not from AGL and the link does not open a power bill statement. It is a criminal ploy that tries to trick you into visiting a compromised website and downloading malware.
Telstra “Refund Bill”; Phishing Scam
The email is not from Telstra. The promise of an unexpected refund is the bait used to trick you into clicking a link in the bogus message. The link opens a fraudulent website that asks you to provide a large amount of your personal and financial information.
Fake British Gas Bill Emails Point to Ransomware
The emails are not from British Gas. The UK’s Action Fraud website is warning consumers that clicking links in the bogus emails opens a malware website.
Paypal ‘You Sent a Payment’ Malware Emails
The emails are not from Paypal and the claim that a payment has been sent from the recipient’s account is a lie. Links in the emails open compromised websites that harbour information-stealing malware.